Our webinar, How to Manage Microsoft Office 2019 for Mac, generated a lot of interest from the Jamf community and a lot of questions from those who were able to join. We couldn’t answer all of your questions fully in the short time we were together, so let’s follow up here with some of your Questions & Answers.
The main focus of the webinar was to demonstrate how to manage Office using plists and profiles, however, presenter Paul Bowden with Microsoft did have “One more thing…” Office applications are now available in the Mac App Store and attendees had many questions about that too. Those are in their own section toward the end.
If you haven’t yet watched the webinar, you’ll find it below and in our video resources section at https://www.jamf.com/resources/webinars/. If you’d like a copy of the presentation slides, you can download them from https://jamf.it/how-to-manage-office.
Preferences, plists, profiles and policies
Q: Does the OfficeAutoSignIn key in a configuration profile work with an enterprise volume license or is there an option to skip that window? Or is there a volume license package that will activate Office?
A: Yes, the key works regardless of how Office is activated (Office 365 subscription, volume license or single license.) Volume licensing is available for organizations needing five or more seats and avoids users needing to sign in with Office 365 credentials. However, apps activated with Office 365 credentials receive more features than other types of licensing.
Q: Does the OfficeAutoSignIn key only work if you are signed in to a domain-joined Mac with an account that has an Office 365 subscription?
A: No. This key doesn’t require an Office 365 subscription, nor does it require a domain-joined Mac.
Q: Does this content also apply to Office 365 ProPlus [which includes the Teams application] or just Office 2019?
A: Yes, the great majority of this content equally applies to both Office 2019 and Office 365. Automatic Outlook account setup using a configuration profile and Intelligent Services are specific to Office 365.
Q: What are you using to view the plist?
A: BBEdit from Bare Bones Software is a great plain text editor that lets you view and edit plists easily. The free version is very full featured. It doesn’t suck.®
Q: Can you also use Xcode to edit a plist on the fly?
A: Yes, this should work too. Keep in mind that some changes made in an application may not be written to its plist until the application is quit.
Q: Is there an AutoUpdate plist that is global to all users?
A: Not by default. The plist for the AutoUpdate application is per user and exists in each user’s home folder. A configuration profile will manage and enforce settings for all users. However, in Paul’s “Walkthrough – Policy or Preference” section, he describes how an administrator may want to create a new plist in the System-wide preferences at /Library/Preferences. A plist here will affect all users but will let each choose another setting if desired.
Q: I've experienced an issue where apps deployed on a new machine don't register with MAU until the app is launched at least once.
A: You can resolve this through a configuration profile that has the Applications array defined. See the example on Paul’s GitHub repository. Use a plain text editor like BBEdit to make a new com.microsoft.autoupdate2.plist file on your desktop and paste in the full plist. You can use the defaults command explained in the webinar to add more properties to the file like the settings for HowToCheck, ChannelName, etc. Or you can copy those settings from the MAU_FullyManaged.plist example and paste them at the end of the file. (See this example for what it will look like when you’re done. Be sure to use the plists from Paul’s GitHub, though.) Upload the entire plist to a Custom Settings payload in a new configuration profile.
Q: Are these managed preferences available to Office 2016 apps?
A: Many are in Office 2016 (versions 15.9 through 16.16.x). But some are only in Office 2019 (versions 16.17 and higher). Microsoft is adding new manageable preferences almost every month. Refer to Paul’s demonstration in the webinar for how to find a plist setting using the diff command.
Q: Where can I find more plist file settings to manage?
A: A great place to start is the community-contributed list of domains, keys, values and their descriptions at https://jamf.it/officepreferences. If you find information that hasn’t been added to this list, please ask the page owner to update the page or request access to edit the page yourself. Also, refer to the Deploy preferences for Office for Mac section of Microsoft’s Deployment guide for Office for Mac.
Q: Are the preferences in the spreadsheet particular to a "minimum version” or “specific version” or just "it depends"?
A: New preferences are added all the time. That means you'll need to be at newer versions of the apps to use the newer keys. For the most part, the spreadsheet does a good job of detailing when a new preference was introduced and the minimum application version needed to use a particular key.
Q: You mentioned that it's not wise to change a plist while the app in question is running. Is it harmful to deploy a configuration profile with a plist to my users if they have Outlook, Word, etc., running?
A: Different apps behave in different ways. Some will immediately change settings when you deploy a profile. Others require you to restart to see the settings change. Deploying a profile while an app is running shouldn’t be harmful, but it may not take effect until the app is restarted.
Q: Is it best practice to deploy the profile or plist for Office prior to installing Office or after?
A: It doesn't really matter. So long as the apps and the profiles or plists are in place when the user launches an application, that's when it all comes together.
Q: What was the URL for the one-click setup?
A: See the Jamf Blog post “Help users activate Microsoft Office 365 and configure Outlook in one click” at https://jamf.it/one-click.
Q: What happens if I use a configuration profile with a Custom Settings plist to set a few of these Office First Run Experience settings, but don't include all the other keys in the plist? Will it wipe out the plist with only the new settings or will it "merge/ add" the settings?
A: Yes, they'll merge! (Technically, if you install a profile before the user can set the preference, the user’s own plist won’t write the setting.) For those keys/values you don't include, the user has full control.
Q: If I push these settings in a profile to existing Office installations who've already gone through the First Run Experience, will it overwrite their choices?
A: If users have already gone through the first run experience, the profiles don't affect them. Remember, configuration profiles don’t change plists. They only override the settings in plists.
Q: How would that “default but not locked-in preference” be applied? Script?
A: Yes, use a script. Or if you’re only going to set the default for one or two settings, consider using just the Execute Command filed under the Files and Processes payload in a Jamf Pro policy. Configuration profiles enforce settings. A script will let you set the default setting but allow the user to change it later.
Q: If I skip the First Run dialog for Intelligent Services, what is the default setting? Enabled or Disabled?
A: The kFREIntelligenceServicesConsentV2Key is not set by default. It gets set to “true” when the user sees “Use Intelligent Services” dialog. If you want to suppress the initial dialog, you need to manage the key and set it to “true”.
Q: Intelligent Services are specific to Office 365. Are there any negative consequences to enabling these on an Office 2019 installation, licensed with Serializer?
A: Intelligent Services works only when the applications are activated with an Office 365 license. Attempting to apply Office 365 specific settings to applications activated using a volume license should have no impact on them.
Q: Any way to disable the Microsoft Store in the apps?
A: Not with configuration profiles, but your tenant administrator can do it centrally.
Q: Are the Terminal commands used in the presentation case-sensitive?
A: Yes, the commands as well as the domains, keys and values are all case-sensitive. The exception to this is Boolean (true/false) values. The defaults command is pretty forgiving with case for Booleans.
Q: Will you have an example of using a Choices.xml for managing installation via stand-alone package? or just recommend using MAS?
A: We didn’t cover how to use a choices XML file since it’s documented in other places. If you don’t want to use a choices file, you can install individual apps from the Mac App Store or download them from https://macadmins.software (the links all point back to Microsoft). You may find the script mentioned in Bill’s Jamf Nation post from a couple years ago useful too.
Q: If Office plists do not get generated until the user actually opens the application, how can you modify a plist before the user even logs in or before they open the Office application?
A: If you as an administrator create the plist first with the keys and values you want to pre-set for the user, the application will use that plist and it will add any other necessary keys and values to finish creating the file. Your settings will be honored.
Q: What is best practice — Installing all the app plists into a single configuration profile or a separate profile for each app — Microsoft AutoUpdate, Word, Outlook, etc.?
A: One plist per app is best practice. It’s OK for a single app plist like com.microsoft.autoupdate2.plist to contain multiple key/value pairs (e.g., HowToCheck, ChannelName and SendAllTelemetryEnabled). Generally, you want to deploy unrelated plists in separate configuration profiles. That’s because when you “update” a profile you’re really removing the old profile from the Mac and installing a new one. For a brief moment, your management settings are lifted before they get reapplied.
Q: Can an administrator lock the user out of joining the Office Insider program too?
A: Yes! Set the value of the ChannelName key to “Production” in the com.microsoft.autoupdate2.plist file.
Q: Can you also specify joining the Office Insider Fast or Slow programs?
A: Yes, through the same ChannelName key in the com.microsoft.autoupdate2.plist file. Set its value to “InsiderFast” for Insider Fast or “External” for Insider Slow.
Q: Can we block/suppress PST files in Outlook via com.microsoft.outlook?
A: Yes! Keys are DisableImport and DisableExport for the com.microsoft.Outlook domain. Set to TRUE for the value. Remember, the domain and key names are case sensitive.
Q: Can this feature slow the performance of the application?
A: Profiles are an Apple-designed feature. They won't impact the performance of the apps, just the behavior of the apps. The settings from plists and profiles are applied at the time an app is launched.
Q: Is there any way to deploy a Custom Settings configuration profile in Jamf Now?
A: Currently, configuration profiles with custom settings are only supported in Jamf Pro.
Q: Will you cover the Microsoft AutoUpdate Caching Server?
A: The MAU Caching Server is more than we have time for in this webinar. But see Bill’s MacAdmins at Penn State presentation “Administering Office 2016 for Mac, Part III: Outlook and Updates” and Paul’s training video “Using the 'msupdate' command-line tool in Microsoft AutoUpdate”.
One more thing… Office in the Mac App Store
Q: What are the main benefits of moving to the Mac App Store for Office 365?
A: You can use Apple’s volume purchasing of apps to deploy Office apps directly from the Mac App Store, which means you no longer need to maintain your own package installers. And you’ll always be installing the current version of the apps instead of possibly installing older versions. The App Store will handle your updates too. Updates through the App Store are “delta” updates, which means your Macs are only downloading the changed bits of the software rather than the entire application each time.
Q: Now that Office is in the Mac App Store, what happens to the other ways I currently deploy Office? Is the package going away?
A: Not at all! The App Store is simply a new way to get and deploy Office. It’s not replacing the package installer.
Q: Are there going to be any changes to the way we can, or will have to, manage Office now that it is in the Mac App Store?
A: Short answer is No. Managing Office apps deployed using volume purchasing and the Mac App Store will be the same. There will be some special steps to follow for converting existing apps installed using a package to Mac App Store apps, though. OneDrive may be an exception since the App Store and package versions are different. Paul will be posting information for this at https://macadmins.software/mas/ in the very near future. (This page is currently in progress. Please be patient.)
Q: How does Office 2019 through Office 365 licensing work in a Higher-Ed Lab/AD environment? Does this require specialized licensing?
A: The licensing is the same, however, Office 365 currently doesn’t support shared activation across all users on a Mac. You can use Paul’s O365SharedActivator script to assist with this for now. Any future plans for enabling shared Office 365 activation for lab machines will likely require an Azure tenant.
Q: How do I manage Microsoft AutoUpdate when deploying apps through the Mac App Store?
A: AutoUpdate isn’t compatible with the App Store. The App Store itself will handle the updates going forward. You can manage when updates are installed in Jamf Pro by editing each app under Computers > Mac App Store.
Q: Can the apps from the Mac App Store be used with a volume license?
A: No. For technical reasons, only Office 365 activation is supported. Perpetual licenses (non-subscription licenses) like volume licenses deployed using the Office 2019 Serializer or individual licenses purchased from a big box store or retailer are not compatible.
Q: If a user already has Office 2019 installed on his or her Mac from an installer package, can I deploy it via VPP and have it take over management of the currently installed apps? Also, will the Mac App Store be capable of handling the updates automatically?
A: Do not install the Mac App Store apps over existing apps. They are signed using Apple’s certificate whereas apps installed from a package are signed using Microsoft’s certificate. This can lead to unwanted keychain prompts to the user. Instead, follow the instructions at https://macadmins.software/mas/. (This page is currently in progress. Please be patient.) Once the apps are installed from the Mac App Store, it will assume responsibility for keeping the apps updated and you’ll no longer need to manage an installer package.
Q: Will Teams be available in the Mac App Store (soon)?
A: Unfortunately, no ETA on Teams in MAS.
Q: Where can I find more information about deploying Office for Mac from the Mac App Store?
A: See Deploy Office for Mac from the Mac App Store on Microsoft’s website.